Act Data Protection And Privacy Act 2019 (3) The office in performing its functions under this Act shall not be under the direction or control of any person or Authority. 6. Data protection officer For purposes of this Act, and in so far as it applies to an institution, the head of the institution shall designate a person as the data protection officer responsible for ensuring compliance with this Act. PART Ill-DATA COLLECTION AND PROCESSING 7. Consent to collect or process personal data. (1) Subject to subsection (2), a person shall not collect or process personal data without the prior consent of the data subject. (2) Personal data may be collected or processed(a) where the collection or processing is authorised or required by law; or (b) where it is necessary(i) for the proper performance of a public duty by a public body; (ii) for national security; (iii) for the prevention , detection , investigation, prosecution or punishment of an offence or breach of law. (c) for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (d) for medical purposes; or (e) for compliance with a legal obligation to which the data controller is subject.